Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CWE-672
Weakness type CWE-672 — authoritative definition at MITRE. A cumulative reference aggregating every published CVE mapped to this weakness class; not a page of record.
Totals
| CVEs all-time | CVEs YTD | KEV all-time |
|---|---|---|
| 32 | 27 | 0 |
Monthly trend
▂▁▁▁▁▁▁▂▁▁▂▁▁▁▁▁▂▁▂▁▁▁▁▂▁▁▅▃▅███
2025-11 0 · 2025-12 0 · 2026-01 0 · 2026-02 1 · 2026-03 0 · 2026-04 0 · 2026-05 3 · 2026-06 2 · 2026-07 3 · 2026-08 6 · 2026-09 6 · 2026-10 6
Top CVEs
| CVE | CVSS | EPSS %ile | KEV | Title |
|---|---|---|---|---|
| CVE-2026-33278 | 9.1 | 65.9 | — | Possible arbitrary code execution during DNSSEC validation |
| CVE-2026-58291 | 6.1 | 61.9 | — | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
| CVE-2026-55250 | 8.7 | 58.0 | — | Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Ta… |
| CVE-2026-68481 | 7.5 | 50.8 | — | Apache CXF: Revocation bypass in DefaultEncryptingOAuthDataProvider |
| CVE-2026-23111 | 7.8 | 42.9 | — | netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() |
| CVE-2026-61699 | 8.1 | 37.3 | — | nebula-mesh: Certificate revocation is never enforced at the mesh |
| CVE-2026-52733 | 6.5 | 36.4 | — | ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork … |
| CVE-2026-56314 | 7.1 | 35.4 | — | Capgo - Deleted Bundle Selection via Missing Deletion Filter in /updates Endpoint |
| CVE-2026-57446 | 5.3 | 32.8 | — | libIEC61850: Server-side double free in MMS ObtainFile task reuse due to stale FILE* ha… |
| CVE-2026-33463 | 5.3 | 31.4 | — | Operation on a Resource after Expiration or Termination in Kibana Leading to Unauthoriz… |
| CVE-2026-44725 | 6.6 | 29.6 | — | EMQX: Stale plugins allow grants amplify a compromised admin/API key to remote code exe… |
| CVE-2026-53637 | 6.5 | 28.5 | — | Sylius: Cart FormComponent allows modification or deletion of an already-completed order |
| CVE-2024-49955 | 5.5 | 25.8 | — | ACPI: battery: Fix possible crash when unregistering a battery hook |
| CVE-2026-42791 | 6.3 | 23.6 | — | OCSP responder certificate validity period not checked in public_key |
| CVE-2026-85044 | 6.5 | 21.8 | — | — |
| CVE-2026-47087 | 3.5 | 19.8 | — | — |
| CVE-2026-95366 | 6.5 | 19.6 | — | — |
| CVE-2026-79010 | 4.3 | 18.5 | — | — |
| CVE-2021-47069 | 7.0 | 16.9 | — | ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry |
| CVE-2024-57929 | 7.1 | 16.6 | — | dm array: fix releasing a faulty array block twice in dm_array_cursor_end |
Most-affected vendors
| Vendor | CVEs |
|---|---|
| 7 | |
| linux | 7 |
| nlnet labs | 3 |
| apache | 1 |
| arista networks | 1 |
| capgo | 1 |
| cyrusimap | 1 |
| elastic | 1 |
| emqx | 1 |
| erlang | 1 |
| forgekeep | 1 |
| gitea | 1 |
| macropay-solutions | 1 |
| microsoft | 1 |
| mz-automation | 1 |
